SRL Archive - Discussions and Debates

spam bots...


footballjds

2012-01-09 10:04:50

I hate leech's, I hate powerbot users asking for "bots", and I hate people that cannot search before posting.

Spam bot's are in a different category. They infuriate me.

Is there anything we could do to flag them? IE, ID them by number of links in there message, density of text(lack of white space, like newlines etc.)

All spam bots have a very similar layout and look. SMASHED together. They generally have at least 3-8 links to external sites.

<3 discuss…

Daniel

2012-01-09 10:06:19

I've banned them all so far. One I stopped in its tracks before it even managed to post. And I've banned this one when it decided to create like 3 different accounts straight after each other -.-

They also have quite a few numbers after their name, sometimes incrementing from a previous account.

footballjds

2012-01-09 10:07:23

From: Daniel
I've banned them all so far. One I stopped in its tracks before it even managed to post. And I've banned this one when it decided to create like 3 different accounts straight after each other -.-


We should have sex sometime.

  1. This forum requires that you wait 60 seconds between posts. Please try again in 15 seconds.

Narcle

2012-01-09 10:10:00

Yeah… after i see post i usually ban them before they post another thread.

Harry

2012-01-09 10:15:57

You are banning their IPs as well as their accounts, yes?

Daniel

2012-01-09 10:16:25

From: Harry
You are banning their IPs as well as their accounts, yes?


Just accounts I think, because that's all we can do.

Narcle

2012-01-09 13:42:00

I HIGHLY suggest we put a time limit before someone can make a thread. Like 3-4 days or something. This will help lower spam bots making threads and stop all the noobish threads being created.

Kyle Undefined

2012-01-09 14:04:15

Jesus, that's a long time. Why not a few hours?

Narcle

2012-01-09 14:06:03

From: Kyle Undefined
Jesus, that's a long time. Why not a few hours?


Any time really, that would be the extreme I guess. Half a day would probably be sufficient.

Kyle Undefined

2012-01-09 14:08:34

Maybe have it so it depends on rank? I don't make a lot of threads, I just know that it could get annoying.

Narcle

2012-01-09 14:16:24

From: Kyle Undefined
Maybe have it so it depends on rank? I don't make a lot of threads, I just know that it could get annoying.


Oh nonono. I'm saying a time limit after the account is created.

Kyle Undefined

2012-01-09 14:19:37

Ahh, ok, I thought you meant after each new thread xD That makes sense.

Harry

2012-01-09 14:36:30

From: Narcle
I HIGHLY suggest we put a time limit before someone can make a thread. Like 3-4 days or something. This will help lower spam bots making threads and stop all the noobish threads being created.

Most spambots just sit idle waiting for that timer to go away. Or spam preexisting threads.

As for lowering noobs, they'd just spam their question in unrelated threads.

Best way I'd think would be to actually ban their IP+email+username. Right now no one bans their IP and they don't even have to use a new proxy to spam again.

bg5

2012-01-13 19:31:00

I'm curious how thay overpass image captcha. Are these image from popular database? They looks very standard…I think replacing them with more custom pictures might help …unless spambots uses exploit to break captcha.

RISK

2012-01-13 19:33:21

Captcha bots have an OCR engine(?) that allows them to identify and correctly answer any generic captcha, beginner5.

Dgby714

2012-01-13 19:52:31

There should be a limit to making accounts right after each other from the same ip…

bg5

2012-01-13 21:03:00

From: RISK
Captcha bots have an OCR engine(?) that allows them to identify and correctly answer any generic captcha, beginner5.


I'm sure they don't use OCR to recognize a dog on the picture :P But you was propably think about:
For me image captcha means (sorry for size ,I couldn't suppress:redface:):


Click a Dog




And this forum uses Enhanced Captcha Image Verification
http://www.vbulletin.org/forum/showthread.php?t=132482

RISK

2012-01-13 21:19:36

Oh, haha. I forgot we don't use generic captcha. Well, it is very easy to grab an image from a website and drag it to www.google.com and search any similar images. Then they can just grab a 'Hot' word like 'Dog' or 'Cat' from the image descriptions on Google.


Brandon

2012-01-13 21:36:24

If I'm correct, there are 39 images in the database according to that link aboe.. AND all loaded by Show.php <– Seen from page inspection, and can be downloaded Via CurlLib. Download every single one, read the question for each.. Try again and again. repeat. OR Label each image downloaded manually then find keywords like "dog" in the question and click the corresponding image.

I used this to download from RS GE.. Just a little modification and you can download from villavu.. Or you can crop a screenshot of the slots that each image lies within. Obviously the below is edited so no one can use it.. but it does indeed work.

Edit:
Also for you guys that did not know, you can go to villavu.com/forum/register.php.. and it will show a list of images and a question.. if you right click each image and open it in a new tab, it can tell you if your wrong or right.. then u close the tab if wrong and do that for all 8 images shown.. this way, it doesn't bother you at all and you just bypassed the entire captcha..

Example: http://i.imgur.com/dNIFV.png <— This is a huge exploit in the way we implement the captcha.. Why? Because no matter how many tries I took, it isn't counted in new tabs.. I can have unlimited amount of tries thus the chances of getting the answer correct is 100%!!!! See what I mean?

From my GetItemsByID thread:

program ImageProc;
{$loadlib SSecurity} //DLL containing multiple libraries for encrypt And Image processing..
{$i SRL/SRL.simba}
{$I srl/srl/misc/debug.simba}

Function ImageProc(BMPName: String; ItemID: Integer; Bounds: TBox): String; //Don't touch this function..
var
Image, Path: string;
FP, Item, X, Y, SX, SY: Integer;
V: Extended;
begin
Image:= GetPage('http://villavu.com/register.php' + ToStr(ItemID));
Path:= ScriptPath + BMPName + '.bmp';
Path:= Trim(Path);
FP:= CreateFile(Path);
WriteFileString(FP, Image);
CloseFile(FP);

ImgToBMP(ScriptPath + BMPName + '.bmp');
Item:= LoadBitmap(ScriptPath + BMPName + '.bmp');
GetBitmapSize(Item, Sx, SY);

DebugBitmap(Item);
if FindDeformedBitmapToleranceIn(Item, X, Y, Bounds.X1, Bounds.Y1, Bounds.X2, Bounds.Y2, 5, 0, True, V) then
MMouse(X + SX/2, Y + SY/2, 0, 0);
FreeBitmap(Item);
end;

Begin
SetupSRL;
ImageProc('NameToSaveImageAs', 561, MIBox);
end.

bg5

2012-01-13 22:21:52

@RISK

Google Test

Ow ,I didn't expect google tool is so powerfull :P I totally forgot about it , I rather thought bots have internal database of images. So…there are two ways to break image captcha breakers:

First - make question ,which is not straight relevant to the picture ,like:
Click Mammal with visible teeth


Second - make picture ,which not exist in google database ==> self-made picture :D

Click Dog


Google Test2

Bot Stuned!

@ggzz

Download every single one, read the question for each.. Try again and again. repeat. OR Label each image downloaded manually then find keywords like "dog" in the question and click the corresponding image.


If I'm correct basically question is filename of picture. However I'm not sure ,but doesn't it hide filenames? So every downloaded file will be named 'show.php.gif'?
Also for you guys that did not know, you can go to villavu.com/forum/register.php.. and it will show a list of images and a question.. if you right click each image and open it in a new tab, it can tell you if your wrong or right.. then u close the tab if wrong and do that for all 8 images shown.. this way, it doesn't bother you at all and you just bypassed the entire captcha..


Isn't it possible to proceed temporary IP ban (like 24h) if click wrong captcha?

Gu3st...

2012-01-14 07:44:59

Most likely, the accounts are not made using a bot, but instead there's a human who creates them ;)

Richard

2012-01-14 08:19:59

Completely agree, they are really beginning to annoy me.

The suggestion of having to wait a few days/hours to post a thread would be quite good, the only issue is that some new users like to create introduction threads, which they're prevented from doing. And often the people that create those threads are those who actually want to learn…

Perhaps prevent links in posts until a week or something?

Gu3st...

2012-01-14 20:45:29

The latest measurements we have taken seems to work pretty good. Take a look at the recent users box, a lot of spam bots there who are banned

Daniel

2012-01-14 21:03:35

From: Zyt3x
The latest measurements we have taken seems to work pretty good. Take a look at the recent users box, a lot of spam bots there who are banned


Curiosity sparks, may I ask what these measures were? :)

Gu3st...

2012-01-14 21:14:57

Markus found this: http://www.vbulletin.org/forum/showthread.php?t=176481

Wizzup?

2012-01-14 21:21:29

Or rather, I installed the plugin.

Harry

2012-01-14 21:30:31

How'd you install it? I thought your license was fucked up. But yay, that problem should be pretty much solved then.

Wizzup?

2012-01-15 05:45:16

From: Harry
How'd you install it? I thought your license was fucked up. But yay, that problem should be pretty much solved then.


I just got the plugin elsewhere. (looked it through and it is legit) Technically, the license is still valid, I just don't get any updates from them, because that's how they roll.